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'abstract-. ... ' '"y- " 

This paper examines tlj€ effecljs of 
the conduct of legitimate social res^krcli.V Th^^^^ fdcuses on 

national legislation dealing with, individitial privacy^ in particular 
the Privacy Act of 1974, and considers Si^verai new statutes which 
concef n. the privacy> of patticipants i researc^h. A large portion of 
the paper discusses (1) .regulations, cpncerninq access to - 
administrative records and data, statistical micr,odata,]iand archived 
data; and and (2) regulation 5 on data handling withiii social .science 
research. The Privacy Act qf 197U peraits^ i^ access 
to personal records maintained by federal agencies and to challenge' 
incorrect information. The law^restricts the kinds 6^ identifiable 
inform a tiqn that an agency may collectr and regulates the disclosure 
of personal information by federal agencies. However disclosure of 
anonymous records for tes ear ch purposes is expressly p^ the' 
law. Following a 1977 meeting between, social scientiiSt^ a^ 
piiv acy Erot egtion Study Gommissionj^ the Coftmi^sicn recfDmmended 
dascltfsure of administrative or research records' in identifiable. '\ 
f ormr for purposes of legitimate research^ provided that certain 
conditions are met. The conditions are generally feaspriabl^^ 
the disclosure of id entifiabj^e records oiust be necd^siary to V 
accomplish thq research or statistical purpose. (RH) > 
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: 'Vv V^^^ teport ibcuses generally on national legislation dealing with', 
^yijidivldual privacy, >r^ the Privacy Act of 1974. It also considers^ 

3 briefly several nejw statutes which : deal specifically with the privacy Ibf 
• participant's in researbh>^^'^ 0 is to outline the probable 

and actual e'ffects of these laWs on the conduct of legitimate social 
^searfl^. We. adhere/to an outline; which "Paul Mutler ' (1978) developed iiil 
otder to^ structure th^ facilitate compiarisdn of privacy' 

laws'iiTi:. developed countries.' . ' ^ . 



. General Ch^i:acteristlcs of National: Privacy Legislation; 
. . ; ; 1974; : ■ 



. 'IJie Privacy protect a citizen's right to " 

privacy by reguiatihg the collection, i^ahagement. disclosure' of^persdnal 
^nformatiorf maint^^^ by.;* gbvemmental agencies.^ It p^ermitsVind^iauals 
;.. t information ' main tained by feder^ agencies ,, to gain ' ^ v 

' access to these r information which may be incorrect.: 

It also .restricts th?: ^^kinds of Identifiable information that an agency^ may 
- coll'fect and maintain^ : . Fin^^^^^ and perhaps , most important , thje Pri^^^^ * 
Act regulates thfe./dlsclosure o personal information by fedWral- agencies . 

; " The Apt Is -the first 'attempt by Congress to provide cdt^prehensive - '^^ 
. protection of van indiyid^^^^^ 
^ f ederal;record systems... Before;^ the Privacy Act, federar data management 
policy vms embod^^^ tjhe Federal Reports Act; //record^ shading 

among agencrii^s w^^ to reducfe the burden and//fexpenj^e of report- 

. Ing, .v,This>poU by ^statutes or r^egulations providing fox 

;<:onfldentiality o sys^fems, e.g.:; Titl^/ 13 of the U.S/ Code, 

V ^ prohibits disQlo^^^^ Census records. " The Privacy Apt makes explicit a 

new general .p^ the right of an indiyi^^^ 

. •dis^eml)iation of «. informatiqn^he or. she provlde-s . to: .t^e' goyem 

V ^, In the United States , as' in Sweden, Germany, ^^ b^^ the • 

.. prigins of; the legislation are mixed, It ^stems from yague public f^irs^f ' " 
x:6mputers, numbers, and .deperson^^zation. It stems from (ibncrete'verl^^ 
abuses of administrative recopi^by law enforcement authorities and' others. 
It ^has been stimulated by her£h liberal a:nd conservative coriceims about ;,th^ 
amount of information /m^;^^^ and atout the. absence cJJ^^^^^^ ■ 

• general law- restrict^ the disclosure . records , And,like>all ;dr^matic ^ 
. legislation, |it_i;s^he product by good anH CQnsclenHbW leaders f 

•as well as fronr :he*work of l§s*s conscientlbus ones. 



! Unlike recent and pending legislation in bth'er countries, tl^ie Act 
' also crefwted a Priyatcy Protection Study Goto to assess implementation; • 

of t-hp ]ffT.T^ -f r^or^^^f fy -T ^ o bT^r^^r■^V^r^TTi^f pj^g ^ and to determine hpw privacy * 
legdslation might be •fextended to areas beyond feHeral record systems, the* 
' establishment oE a temiporary Commission in this instance is a remarkable 
illustration of legislative willingrt^s to anticipate weaknesses i in the 
law,;, and to cgreate: a mechanism for Identifying deficiencies and methods , 
:of correction. ' • \ • . r 

» . ' ' sT' ■ ' . . " . , ■ ■ * ' . . 

The (Origin, s^tructurie^ arid content of the law make clear Congress's t. 
strWg interest ixi administrative usgs of administrative record systems. 
.Indeed,., in examining the legislative ^h^arings leading up to the Privacy 
Act; we \Jere Hin^alsle to discover a is inglje.- reference to researchers' abuse 
of administratftve* records or of xreseaj^CQ -i^ecords to 'which they were pro-- 
vided accesi^;:^ ^ ' ^ ' . ; 

1; The Distinction between 'Statiistical, and Administrative Data 
" ' r . .• ■- ■ , ■ • ■ ^ ■ . ■ • . ^ • ■ . . ■ _ ..■ 'y. ■ ■ 

Section ,552 (a) of the Privacy Act enumerates 4eflnitioi|s and dis-. • 
tinguishes I between ^'record" and "statistical record." Jhe definition of 
statistical rec0*r-d hinges on ^use: it is* a record; maintained^ only/for 
statistical < research purposes , which is not used for making \ determination 
about /dn individyal. "Record" on the other hand is. defined in terms of ' . 
'content : . "an item. , .including i>ut not limited to education, financial trans- 
act±oris>.," and containing individual, identifying information. The. definition 
of recard implies that "record" means both administrative and statistical 
recotdsV* TIiei:e is no special provision or recognition .of the phrases statis- 
tical' data, and administrative data ±n the current 'Privacy Act . The report 
of the Privacy Protection Study Commlssion*shduld help to remedy these 
shortcomings* ' , -/ ' - s • >. - 

/ The Commisslqn report takes pains to recognize the . "functional ^.dis- 
tinction between research records and administrative records. An admin- * . 
is trative record is defined in term^ of its use, for arriving at an 
administratd/^e decision about an identified individual; a research record 
is defined as anyforto of record used solely for research ot- statistical 
purpose. The same distinction is made palpable in the Commission's dedication 
of a .major chapter in .their report to confidentiality issues and the researcher 
Th*e chapter is one of sixteen which deal with topics ranjging. from privacy 
problems in employment settings to tl^ose in law enforcement agencies; The- 
fiinctional distinction^ used in the Commission report is nearly identical 
to, one proposed earli^ by Boruch (1971). ' . . 

Speoial statut^es- designed to protect confidentiality, of 'social research 
data V which, we discus>5 later, also, define, statistical .record and research 
record primkrily in terms of tlieir use" (i.. e. , no determinations about in- 
dividuals) but do npt define administrative records explicitly. . . 

;-v/;:' , .. '. ■ ..^■.....■■.„ ■ 

2* • Deflniti^ori of Anonymous and Identifiable Records ■ 

. ■ •• ;. . • • * ■ ' • ' . ' ' 

. The Privacy Act bears primarily on "identifiable" records and uses the 
.word identifiable In p^^ conditions under which' recordB may be fe-;. 

leased, for -exai^^^^^ But It provides no expilcit definition of «the term. ' 
The Privacy P.rotl^tt ion Study CommL^^ report recognized this w^kness and ' 




of fered^a def i^ ^gf^ S^g^ f d^a t ion :ln individually identified fo.rm::_ V'aijlyr 
material •that c 9U;^l^^|^Hab ly be uniquely associated with tpe identity ^o^^^^ 
the individual. ^'^fco,^^ . • - - . /y:.;'-, 

^ Mindful of the administrative burden on: agencies <7hich would result - / ^ 
if ^coverage concerne(^il ideiitifiable ' information, ^Congress restricted^^^^^^^^^ 
; the coverage of the . '^^} to records which are contained in a "system of '"^■'■-"■i 
. .records.,":furthef dr^j^^d as "any group, of retords from which information v'i ■ 
' .;,is^ retrieved by the?MS^ofv the indivi or". - 

other identifying paS^^lar assigned; to the "individual:" This d^^^^ - 
: '^encompasses a vast number of the identifiable records maintained by federal. " 
-^'agencies^ but It does not extend, to those ^record systems 'in .which the ipforin-- 
■- ation'is nofactuklly retrieved by individual Identifier. ^ / ' 

Merely removing the. name or individual : identifier from the recq^tci - 
usually^ will be a sufficient guarantee of anonymity to permit disclosure 
.pf records under the Privacy Act's exemption for statistical research. • 
However^ this iriay be inadequa if public records are available to aid 
in identifying _^the anonymbiL;s 4^t:a. The exemption states that di^ V; 
is permitted only if t^iSr-record- is "in a form which is. hot individuaXly 
identifiable." The Qffice of Managementf and Budget' Gui.delxnes fo^ the 
?^rivacy Act interpret this part of the law to ^riean that the identity of 
the individual canpiot be deduced from tabulations or other preaentations / : 
of the. information. Where such deductive disclosure is a thr6a.t,>the agency 
will Rave to take precautions beyond .the simple deletiq^^ of individual 
identifiers if it wishes to disclose records. . .'"^ " 

The.-OMB guidelines , which recognize', the possil?ility of deductiye . , . : ' 
disclosure, are an institutional interpretation of , the Privacy Act . In • / : 
this sense, the legislation can be said to.'recpgnize ..the concepts of" arionymous 
,ahd identifiable record; the recbgnition is imperfect in part 'because/very 
. liiztXe is known about the likelihood of deductive disclosure, based oij . (osten- 
sibly) anonymous statistical records or tables.' , ' 

; To accommodate this problem, the Federal Committee on Statisticar'' 
Methodology, jan interagency group, created a* Subcommitti^e ori^ Disclosure 
Avoidance Techniques anjjt their" report .outlines definitions for exact 
deductive disclosure, apprpxlmate and pro^bilistic disclosure. It also" 
describes techniques for 'dealing with, the^r^lem. It extends but fails 
to^recognize earlier work in Sweden by. the' Central' Bureau of ' Statistics', 
in Germany by Sjhlorer and others, and ih the United States by Hoffman, 
Turn, and others in academic; resea'rbh: . The Privacy Protection Study - 
Commission refert^ces the Federal Comraittee's 'work, and refrains from aij^y' - : 
' specific statement^, about deductive disclosure. ^ - . 

■ ' ' ■ r-'\ ■ ^' .} 

3. Provisions for Research or Statistical Utilfzation 

. The Privacy Act of 1974 has no detailed provisions for utilization of ' 
data for* research. However, discltisuire of anonymous records for research 
purpose is expressly permitted by the^law. While no similar prdyrsipn' exist^ 
to permit access to identifiable inforrnation fot resear^ch, the Act implicitly 
recognizes the researcher's need for siich access (see Section C, below) • ' \ 




EKLC 



. Pattly because, research uses, of record^;|ye?:e Airid 
V Act .and lignored entiirely in other privacy irelat-ed Xegisiatiori, such as the . 
v,Tax . Reform Act. of 1976, Boruch; (1977) inade the^fplibwing; propd^^ the . 

'Priyacy::*Protfection :Studyv In orde^-.tg ^ivoid the kihds of un- 

-necessairy statistical rese arch / related ^prpblems?,6ng^dered by the^ Privacy 
* ■ Act , . by ^the-Tax, Reform ;AQtr; aSatT)^^ legislaitioh , bilj,s which Hiay ' ; 
. bear qrf statistical research should be routin^l^^^^^^^ for Vheir i2?pact 

on that re^sear^h. It's ijot cle^irv* for example, thit ;the 20 or so; majot- A . ' 

medical studies vhich capitalized/on addresjs^ li^ 

/.Intemal -Reyetuie Service over the- p^ast 10 years (without 'negat^vd^ consequence 
iCpr; the addressee) were even considered.. in the Tax Reform Act hearings/ (See/'v 
^ Section Cf.l)^. Yet the routine use of- lists for wojrtliy sociortaedical re- . • ' • 
.^search hais been ^terminated under the_ Act acc id entail^ arid essentially' withoiit^ 
■a fair hiearing. * A mandatory "statistical research impact statement" or . 
similar evaluat4.bn device should .be a part of the roiitine legislative review s 
process . Moreover ,^ tt^ is" not on3,y^goyermnent statisticians who bught to be • ^ 
involved in the process • Epideraiplogists , i^sychologists, ec6nomists,t aud . " 
others outside goverri^^ be given ^a. better ^dppo^tu to /participate ; 

.,in..;tlie. 'process than ncvr .exisifis/ ^ ^ ■ .i^/ ■ ' :* ' 

The Privacy Prptect:|e)n^ Study Commis ; , 

It did, however, capitalize on other liiaterial, from that/: on " 

testimony byv social scientist such^s Flaherty.i' X^astwirth; ^^^^^ . 
and by. medicail researchers- iri co^^^^^ reseat^. : The;:Commis^ion repoirt / ^ 

•p.uts notable stress^ori the "citizen as research participant ,". the value 'of 
„ and need for research, the .impprtarice of. researchers' .use of administrative 
records for research purposes', and the secondary '.anaiyslsaj^f, research inform- 
ation. So, forVe>iample, Copni^siqn RfecommendatioV, '^^^^^^^ discl'dsure 
of administrative or researchJre^ibrds' In identifiable form', for .purposes of 
le-gitimate research, jprovided .thatr certain ^nditiotis are met. The cdnditlons 
ar^ generally reasonable, e.g. :, the disclosure of identip^^ must 
be necessary to accomplish tli^ research or -statistical ^purpose- ; ■ ' 

Regulations Concerning Bata .Cpllectlon , 
: X. Geileral^ Regtrlktions V V ■ 

: - • Tp guard agains^ the promiscuous :collecti6n' of .information the A^t 
•.requires that ageiiciea shall maiiitrain ,"pnly siich information abftut an , 
individual as » is relevant >nd necessary to 'accomplish a pxirpose of the 
agency required to be accomplished .by stattute or executive order pf the 
President." lii the cotitext of. record systems used for research, this 
mieans that the records must be linked to svich authorization or the record 
system win ie in violation the Act . Since much of social research 
is exploratory in: nature,. -the naifrbw^ i^ and strict enforcement 

of this requiremerit: could sharply limii: the collectipn of social science 
data*. ■•. •' . 'v'''^-" . • •; ' ' ". -'X- - ' -r .■ 

Each federal agency is responsible for interpreting arid applying this 
sectioT^ of the Act to its .own record systems. . Unlike Swederi-s Privacy Act, 
^ the Initiation of a. new c!ata pollection effort need not be reviewed by a 
central Data Inspectiori BoardV Within an agency such as the. y. S.' Office ' 
of Education, hbwe:ver, other no less Irifiuential committees of independent 



reviewers, /set up. under o for- a new | ' 

research project. In addition, pe^r review of research-lpropo^als' ^^i: 
submf dted for funding to.; thie f eder^i government are rqutinely reviewed. ,5^ ^ 
for their importance^v \ * - J^i 



■ The privacy Pratection 'Study Coimi^ssion : -. f^ 

on information collection haj^ had yery little effect on niaintenarice of .'^..j?; 
agency, recprdis t It ""f ound thkfc ^ in general , agfiency prac^tlces have not : 'fi^ i .1 
changed afcd; ;there h^b be purging: of existing, tecord. systems. [vif 

^However, th^re are indi^ that the^estrictibns may have had siome -^^'^l 

. •l^effect byv discouraging :agencies^!from ■ if p;^ 

.. ;new information cbllection' jp.rpg are b^ing discouraged, this coul d^ v ;J: 
./he especially hamful' tb;^ research activities . It ' s 'not clear trhat* the^ 

3 information* aya^ilable- -to was adequate toVdfetemine 

• :;.the restriction *;s effect, il^^^ presented ; ^ rio .case 

■ studies of any. inipoBt are discussed ; no^compet'lng explanations for the 
V cancellatioTci of Si^^^^c(^d systeiir are idenbif ied ; .no sampling scheihe for 

the Commission's surv^e^ system^ is establishedx It *s .possible that, 

the Commission' s iiiv^tigations "on ^^r stability of jrecord systems 

•were- prematutrei ■, ' • ' ■■'''^'■■\:.\/' . . ' ' [ \:: ■ . ' \ \ ■ 



Five factors help td:mitsigate-t^ potentially harsh effec/: of this 
riBquireirieht applied to retsearch riecofd systems/ First, t^iere'^ is no 
.central review hoard of laymen to register, judgments .about whether 
-*,,^^lenti¥iG data is necessaify or ' relevant . . Such a board would doubtless be 
asr disrupl^lve in the United States as it has. been in Sweden. • • * 

Second, review bodie^ which include bo^th researchers and—the lay public 
already r.eview research proposals in the special areaS governed ;by each . 
. federal agency. Thougji they are imperfect ^ though their pierfontiance is 
not always Weill documented, the boards have had sufficient experience 
arid influence to make additional reviews unnecessarily redundant *_Jhird , 
somie research proj:^cts have received .explicit or 
implicit authorization 'ift the statutory . statement of the. agency purpose. ' 
Such record systems clearly meet the stamitbry requii^eme'iits of thfe Act. . * 
- For example,, the tTa'tional Institute 'of Education is mandated "to support 
(^educational Research, the* U.S. Office of Education is oft^ required 
to evaluate educatibnal programs , the National Center for- Educa:tdonai 
Statistics is dedicated to compilation of statistical data on -the 
educational state yf the nation. All these missions, are predioated on' 
the .assumption that some information is essential for improving the quality 
of education in the United States^ Future record systems are more likely 
.• to receive explicit authorizatiojTnow that this Privacy Act requ^ement 
has been enacted. The fourth influential factor is that the head of an, 
agency may exempt from this requirement' those record^ sys tems "required by, . 
statute to be maintained and used as statistical r/cords . "(emphasis ■ : 
V added) . ' This statutory language has' been int.erpreEed by some, agencies to 
protect only those systems of records which are prohibited b;y -statute from V 
being used tp make a determination about an individual. Not only must . the /. 
r record^be restripted by sta^tute from use* 'for administrative purposes;- it • r 
must also bep protected from compulsory legal. pirocesS. There are very few ■ 
statutes which offer such absolute protection':^to r;esearch records, and 
. these.are discussed in Sie.ction F, below. Even these research record systems 
have been exempted only from the notice,' access, and correction requirements 
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of the Act and must still comply with the provision requiring information 
to be relevant and necessary,. ' \^ 

•The second major general reqi^rement of the : p/ivacy Act i^ 
agency gathering research information directl^f f r6^^^^^^^ must v ■ " . 

Inform each individual of the authority which authbti^es the solicita^^n ' 
of the information,, the purposes for. which the informaition is to be ased* 

.. whether disclosure of 3uch information >i« mandatory or voiuntary, and, tlie 
consequences to the individual (^-refusing to provide the requested" 
information. .\These disclosures, commonly referred tO*as the "Privacy Act 

^Statement," arfe in. response to past complaints that agencies Have used 
pressure, deceit, and coercion to 'gain, i^ersonal infoTrmation, *While. ;j:hese 

. prdVisions will encourage the collection of . information' with" the knowing 
and informed consent of the individual respondents, the effects of such 
itiformation on cooperation' rate ituresearch have qrily recently become a • * 
^'topiq>.of methodological . inves^(igation. Singer (1979) , for example, has * ' ■ ■ 
initlAted very nice experiment^.to assay\the effect of amount and type 
of ^information on response rat»e and c^dor.^ * o: • ' 

•*2. Cross-sectional , Longitudinal, and Observational Studies ,* . 

No provisions of the Privacy Act or of. any other priv^cy '^regi^Iatipn ' . 
distinguifsh jgrnong crossrsection, longitudinal, and ^observational, studies. 
The l^rivacy Protection .Study Coijmission Report definjes "longitudina:l 
research", though no bthei; distinctions are dnawri. Their defiriifion hinges 
on establishing "how the state of a group varies arid the average relation ♦ 
between states" over time, and iClpsely follows a definition in Dalenius 

. and Klevmarken. (1976). ' . ' • ' 

' • ' ■ ' • . . ■ * ... 

' • C. Regulations .on ^Acces^ to Administrative Records . J . 

• • • . ■. ■ t ■ ■ . . ■' ^ ' ■ ' .' ' •*_■.' 

1;. Access for Sampling [purposes ' . * . . . 

'The^Privacy Act's prohibition on diisclosure of identifiabler information 
withoiit the prior written consent of the^ individual could sharply restrict 
the use of administrative and other records for sampling purposes. In 
' particular;^ researchers occasionally seek access to agency record systjgms 
to obtain a- sample of individuals for anticipated, research or to supplement >;: 3 
existing research information. The consent requirement could interfere witHK; 
both -of these activities. ■ f 

When seeking to supplement existing research data with information 
' frSin. agency recprdis'^ researchers witLi oiten he able to anticipate thia .need r' . 
and obtain the informed consent of • their research participants at the time 
the research information was collected. However, if the n'eed for access 
to agency records was not anticipated, the researcher may have to recontact 
' the iridividuai to obtain consent. Evea if fhe individual agreed to . subse- a 
V quent release of agency information when the research information Vas ^ 
initially cojllec ted i if the researcher seeks access to research records 
which did not exist at the time consent was obtained, the earlier consent 
amy be invalid and It mdy. be necessary to recontact the , individual to obtain 
proper consent . HooontaoCtng a particlpaul in an ear Her research study 



imposes fippn'fll rfi f fjfrjil f -f P.qL.^-» <^nm<a target populations are Jfciighly mobile, 
sa that addr^sse^Va'nd telifephone numbers Obtained at the initial encounter • 
may be outdated^ Some target populatibq.s. are dif ficuj.t to recruit"^ for 
research, sD :that subsequent attempts- to obtain consent to. release agency . 
inforinatioh Vill likely be expensive and subjebst to biases in .self-selection. 

■; • ■••.C./-;-V'- . ■ •■ : ' ' ' ' • ■ 

, ' More^jSormidable obstacles are facied by researchers who wish to 
use agerrc^- records tp'generate a sample of identified individuals to be* 
contacted for participation in antici^jiated research. Since the purpose 
of obtaining access is *to. obtain a list of names and addresses of in- ' 
dividuals, the^reseairch will ie unable to obtain consent for release - . ' \ 
6 this information. Researchers eiuployjed by the agency maintaining .. .^ ^, 
the records^ may avoid the consent requirements by demotist rating a need / ♦ 
for the recor(f in the performance of their duties. But researchers oufside 
the agency Have found ^he consent requirement 'to^. be a frustrating hurdle. 
For example, the Medical Po 1 low-Up Study ,\pojkdt9i«;^^ the National Academy , 
of Sciences, demonstrates the cj'if f iculties-^^ cons^rtt requir^ent poses., 
for non-federal researchers who must reiy jupiDnJagency rSecords to generate 
a research sample. The ^tedfcal Follow^U^Stt^y^ longitudinal research 

prbgr^am on the h^lth and medical statt^a/^of ify^^^^^^^ The 
program, which began in 1946,* was desimed to ■capitalize on the 3normdus 
pool of baseline medical data collectafl as part of the normal military 
processing of servicemen. Those data [have, been, used to track the natural 
history of a variety of diseases, espdciallly those diseases which occur too 
infrequently to. be studied through cuscomary sampling procedures .. Since 1973, 
the name and addresses of veterans selected for -^the Fpllow-Up Studies^^.w^ 
obtained from the Taxpayer .Address ReiAiest Programi-drf the Internal Revenue. 
* Service. With current addresses, researchers the^i. .contacted the veterans 
to explain, the purposer of the researca arid ri^ue.sV;'t^ release 
of medicar information. In April i97(fe, the itt&^-^^p^ 

' ruling that the Rriyacy Act prohibit the disclosure of -current addresses 
without the consent of the individual. Without current addresses , these 
extensive fbllow-up. studies will be*;t,erminated. , 

Because, of such problems , tl;^e .itrivacy P'rotectlon^^S^^ 
dedicated special attention to researcher/use of adiijiiriistrative records, 
including use of sampling (p. 588). Several recoraipend^tions are offered. .'.<, 
to resolve problems: . Recommendation. #7. 'permits autoinatic disclosure of 
administrative records, without individual authorizatibn^but under certain, 
conditions, for research purposes ; Recommendation f/9 prohibits redisclosure 
of the information by the researcher unless the sanre conditions . are met. 

Regaf(ifiLess of the Commission Is recoiMnendations, it is ^sometimes - 
possible to employ special . procedural .strategies to circumvent pro- 
liibitions against disclosure of individual identification. For example* 
the, archive may ^.be asked, by the researcher to sample the records in 
accordance with instructions and to. forward questionnaires to the in- 
dividuals and to ask individuals to return questionnaires to the researcher. 
There is a w ide arr ay of such procedures, but many increase the cost or 
difficultly of researcVi, and may not be > feasible in the particular research 
■setting.:-. ^. •••^ " \ '; ; / ■ 




"2. ^ Access a Data rBase ' . • , 

In 'general ,i such acc'e«s to identifiable records is permitted for out- 
side researchers only ff the individual provides consent fSi£ disclosure of 
the record.. Disclosure of records b}^ one agency to another for research 
may be permissible under the "routine uses" provision^ of the Act. The 
latter exemption is .ambigilous, however., and a novel, research use may be 
^ refuse^; at the discretion of the agency. - . ' . 

'The. changes in the Privacy Act proposed by the Privacy Protection 
. Study Commiission would acknowledge the propriety of access to identifiable 
records for research purposes, permit-ting broader access to and adopting 
formal mkasutes to insure the consent of the individual who provides the 
informatiW.' /A. major, factor in the Commission's wilXingness to perrait^ 
greater access for research purposes is the protection which would be 
accorded* research tecords if the Conmvission's recommendations for a 
functional 'separation of research and statistical records- are adopted. 
Since suph a separation would insulate. the^research;'reco:^d from uses^whic 

h^j Comm 



wouldvbe detrimentai to the Individual, th^^ Conmiission was willing . to go 
- quite (far in permitting acc;ess to identifiable records f;0T regearph purpoi 
:"\Hdwever,;--the Commission would permit access to identifiable information 

from adml,nistrative files, for research purposes, only when it is absolutely 
. necessary .(Recoiranendation, ^ interagency agreements oii the 

matter (#8) , and would ' / 

3. ' Access to Administrative D^ta for Linkage. v . 

* A Privacy Act Exemption which may assist the social scientist- seeking 
_ identifiable information permits the transfer of identJLfiable agency records , 
to the Bureau of the Census for planning, or carrying but a census, survey, 
or other related activity.; Th6 law w^ll permit llnl&ges. between agency 
fil^ when coridujdted by the Bureau of the Census for some purpose isuch as 
to establish the credibility of these alternative sources of informatibn. . - 
Furthermore, this, exemption 'wouW seem to allow the Bureau to accept iden- 
tifiable agenpy records 'to perform certain statistical analyses for re- ^ 
searchers outside the Bureau who are unable to gain access .to these records.. 
Presuit^bly such analyses are a "related activity" under the ^ exemption, and 3 
the Bureau will con-tinue to act as a. brokerage agent to perfo^ such research. 

.Aside from this special provision, the Privacy Act dedicates no attention 
• t© the need for record. linkage or. its implementation. Because record linkage, 

between administrative and research* systems or between 'two research systems, 
' oan be important' in. research and because the Act's inattention to. the matter 

provokes confusion, the Privacy Protection Study Commission discussed the ^ 
'Piatter> It .refers specifically to data sets which are "dnterlinked" for ^ 
; research purposes \(p. 586y and the ex of ^pifocedures f or linkage, such 

as brbkerage or insulated file linkage, which accomplish research goals 

without breaking privacy. • Again , to clear the way for llnkagia f elated uses 
.of administrative records, the Commission's ^recommendations on disclosure (#7), 

intoragency agreement (#8), and reidisclosure (#9) should be helpful tb re- . 

.soarchors K"^th within and/x)utslde government . . : , : . - 

Trrospoct Iv.o of tUa Commission recommendations, the procedural . ; 
cjppriiaches to Hnklng recdrts 'from different ; archives without breaching 
privacy regulations governing disclosure sttll appfe^r appropriate. See 
Section T.2 below and BarHjch and Cecil . (1978) . - 



4- A General Exemption which Bases, and^ 
. Lirikage, / ... 

A major Privacy Act exemption which might benefit social scientists permits 
disclosure oj an identifiable record for a "routine use" such a Jrecdrd. ' . 

Routine use" is defined as a usa."for a purpose which is compatible with 
the purpose for which , (the record) was collected." Such ambiguity in 
statutory language suggests that an agency might be free to define ! 
"statistical analysis" as ^ routine use of all or a selected portion of 
agency recprdVsystems,' permitting researchers outside. the agency to have . ' 
access to identifiable records without gaining-the consent of the individuals * 
to. whom the records pertain. In fact, almost all agency notices allow for 
disclosure involving statistical research programs as a rputfine use. If ^ 
thlsr designation is extended' to the record system of interest to the social 
scientist, the researcher- may have access to the identifiabLe. agency record, 
system for research purposes without the consent of the individuals. Sucii a >. 
special, exempt ion may be helpful to social science research, but thci legarity* 
of such an exemption may be questioned. A House Committee Report (H;R. Rep 
No 93-1416, v93rd Cong., 2nd^ Sess. 12 (1974) recognized /the potential foir abuse 
of. the routine use exemption- an^ promised vigorous Oversight 'of agency 
practices in. this area. If tfiis Resignation has been 'extended to a sufficient 
number of files tb result in a general exenjption for social ^ientists , it v 
may be teste|l 'in court - arid f ^und in violation -of the Privacy Act ; 

5. Suntmary on Access for Sampling, Data Bases, and Linkage 

The restrictions of the Privacy Act are sufficient to d^nterfe 
with access to agency records fdi| subsequent research activities. Unless 
the researcher can invoke' one b$ the exceptions to* the Privacy Act;. access 
to identifiable ^gejicy records: is forbidden unless the consent of the. 
individual is obtained. While exceptions - to: the Privacy .Act may restrict 
protectdbn :of confidential research records, they also represent th^ only 
means by which researchers may obtain access to regulated record systenjs; 
• The exception most likely to aid researchers pei?Mts agencies to disclose 
informatioti for purposes of ; statistical research if., the record 'is trans- 
ferred in a form which is not individually identifiable. ' In fact, records 

not individually identif iable are rifot regulated by^ the Privacy 
Actv This: suggests that the. statistical and procedutal techniques such as 
insulated file linkage,- which permit meaningful analysis of data while , 
preserving the anonymity of the respondents, can be alternative analytical 
techniques when the. Privacy Act restricts the release of identifiable records. 

^. . . . V- Regulations Gonceming Access to Statistica^^Ilicrod^ta . ^ 

1. Public Use. Samples- * . - ^ ^ 2 V^ 

. There.. are no; special provisions, in. .. 
require prdduction of pu.blic~use' samples. The Act doies permit pubXic use .. 
samples in the general sense that disclosure of anonymous records and- statis- 
tical data for= research are exjpressiy. permitted. Further , records which are 
used: solely - for statistical research purposes are. exempted from many portions 
^of* the Act ,^nt)tably those which give injiividuals the right to access their ' 
own. record". •. 



Integration of Microdatat Files" 



.. ^, ■ T - . ... ;., • . f t " ■■■ ■ ■ 

Thfe Act's main focus is oji/preventing unnecessary ttansfer of identir - " 
■ fiah*e- administrative rjBcords across agency boundaries. The Act majT iinpede . 
somie linkages ^i^rig research data archives.; ' ; . 

Disclosure off statistical recdrds -is expressly . permitted under the . . V ' 
Act whether the records "stem from adminiktrativ^-.afQhi'yes or: rese-arfh i • 
archives, Th^ main qualification on disclosure is that the recbrds 
contain no individual. ;identa^ication (sep Section A .-2)'. . As., a .matter of. ■ ' .. 
practice then, this means ^ thait ; statisti^cal r'ecords itnay . be transferred ■ / 

; from one government agency to another, \ or from gciVernment to. the. i 
pendent research. _Once the transfer is. made, limited integration pf .. 

>^dif ferent microdata files is possible. V.The ih±egratiorf^^ simply ; • 

because the records coij^tain no individual, identifiers. .VFpr example, > 
government ai5:ency . A qr its contractors may pdssess' information on educiHiion 
and employment of individuals in ^pe^^ school di^trictc during 19.60-1970, ' 

. Agency B maintains similar -information fbr 1970-1980;. The integration of . ' 
statistical data,l)ased on school districts rather . than individuals wi.thirr . " 
school district, is pejrm'issible and possible. But the resultant integratied 
file limits analyses to tliosfe characteristic of Work on .micfba^gregated V 
.samples. ■ v ■" n 

. Ihtegration of an^oAymbus; records, on the same dr different- individuals 
iis also permissible under this disclosure provision; of the Act. Siich 
integration has a relatively recMnt history*' however . Tlie statistical re-/ ; 
search* on synthetia matching and oh methods, for linking anonymous records / 
.on tl»^ same individualsv is still developing i. .\T^ techniques are compixcat6d 
and gen.erally produce a kind of analogue or imperfect; surrogate for aii - . . 
integrated record based on clear identification. See , for example, Moore; ' . 
Kuhns, Trefftzs, ;^nd Montgomery (19 . ^.^ - ' ' 

Privacy Act provisionsvwhich permit linkage of records for routine 
use anS the special exemptio\^^^j^r transfers of ;^ 

Bureau facilitate some efforts to :integrate. microdata.: In fact, because, 
identifiers can be used as a basis for integratioti in some of these caises^ 
the process is no more than recoird linkagfe for- research purposes. Jabine 
(1975), for example, observes that integration ; of :Sociai Security data 
with data held by Census Bureau, by SSA contractors, and .x)ther proj.ec cati 
be accomplished legally thrbugh disclosure of SSA records (e.^v-r identifiers . 
only or identified information) . .The. Social Security research on quality • 
and character of reporting i;equires linkage in these and <)ther.. projects, - 
and such research is ro\iti'ne. However , Jabine expresses some concern that ' 
sbme integration projects may be cawceled if "deemed not directly -related 
. to administration of the Social Security Act". .■ : 

E.- Regulations on Preservation and' Access to Archived 'Data ■ \ : ' 

■"'"l'/''*Publlc' Archives. ......... 

■ . ■ . ' . . ■ • ■■ ■ ■ • • ■ i' ■' ' ' 

Tho Privacv Act refers to trahsTer of ident^lflable records to the 
Nnl Ioua1y.\foh tvjt»s only If ..the record is of suf f Lc.letit hlstoricfi]. merit . * 




. .• . The Nat iipijai: Af has recently undettaken to acquire .and stare .; 
statistical v(anonym6^^^^ stemming, from federally supported socMl/ . : + . 

prdgram eValuatiQns. - Its enabling legislation giy^s the National Arrives V 
, the right to do so but no iiatipnalv legislation, nor provisian. of ttie-^ "/ 
Privacy Act-; requires - the National Archives to store such reseai^gh datai v* :;' ^ 
•Routine storage will of course facilitate secondary analysis of ^tatistical-^ - 
.-data,-.' •.. ■ V • ■' ' ' . -Vv'- " 

■ ■: ^ . ■■ ■ ' ■ •■. .. ■■ ■■ : . ■ ■• •.- ^^'-.V- . ' ■ 

Other archival; sources of statistical data .exist , notably the. public ■ 
•use data tapes made available by the U. S. Census Bureau, the Social Security ■ 
Administration, National Centervfor ^Health Statistics, and other public arid ■ 
private .agencies. See Hedrick, Boruch, Ross (1978) ^^nd the references thet^ln 
The. Privacy; Act appears to fee relevant to these only in the ^rise of:;^ generally 
permitting disclosure when -identifiers are excluded. ' J 

-2. . Conditions of Access . . v- . ^ ^ *' - ! . ^ • . v 

' 'Generally speaking, access to . statistical data or anonymous records , ' 
maintained, by the NatiiSnal Arch^ and cithers mentioned abov.e is, conditional:^^ 
.on written request and nominal payment- for 'costs, of tape- reprodiittion or f ile ! 
documentation; W records are at issue,' the rules for re- ' 

searchers gaining ^cess are determined by the. agency maintaining the records/ 

; ^ere staff of an archive believes that disclosure ot^andnymous records 
or a sampie. of anonyTnous records will jegpardize individual privacy, then 
the P.rlvacy Act will not require 

*"«-■' ■" ■ * ■ , . ■ ■ ■■ . ■.■.■*■'. ■■ ^ ■. ■ 1 ". • 

. . ^* Regulations on Data Handling; Witliin Social Science ^llesear ch^ / 
!• Cbnf i^entiality Assurances - . . * 

: ; The. Privacy Act of 1974 makes ho unusual demands of social scientist in 
handliiig research data. To. rectify the inattention given to research records, 
the Privacy Protection Study Comraissioii offered several recommendations on 
confidentiality assurance. The most important (Recommendation //I) require 
that information collected for research purposes be used only for that purpose 
^nd not, for making deten^nations about individuals. • Recommendation //2 ' 
buttresses this, suggesting that legislation be created to assure "^t hat re- 
search reco;;ds cannot be appro^ialSd for ^onresearch use. Recommendations; 
.7/4 and //5 put time constraints. otiA'inaint'enance and require the research to set 
physical confidentiality assurances. 

• Recoimnendations //! and #2 of the Commission report have precedent in 
hew law which extends special legal pirotectio^n "to the social research and the 
research participant. We describe seve^ral statutes which provide testimonial 
privilege to the researcher below, adapting descrlptlorifrom Boruch and Cecil ? 

■U9.78): ■ . ■■ ' 

■ The statute most; frequently cited as. providing protection for non- 
governmental social scljM£i.e research is . found in §303 (a) pf the Public . 
flealth^Services- Act; (PuW L^ No.- 91-513) as amended in 1974 (Pub. L. 

• llo. 43-282,. encoded as 42 U.S.'cJ.A. §242a) . This statute: permits the v 
Secretary of Health, Education ■ and Welfare to: ' . ' 




authori^^e persons engaged in research on mental health 
including reseia.rch on. the use and effect of alcohol and 
.other psyclioa^ctive drugs, , to protect the privacy of^ 
individuals who ; arW: the subject of such research by with-- 
holding from/ all^ p^^ connected with the conduct 

of such Research the names or other identifying charac^ 
teristics of sucK . individuaAs. Persons so authorized to 
protect the privacy of. such individuals may not be com- 
pelled in vatiy. Federal, State, or local civil, criminal, . 
administrative, legislative, or other proceedings to 
identify such individuals. 



— /r» • • • • . ' ' ' ■ ' ' 

Ml The scope of protection offered by this statute is still open to 
interpretation. The 'proposed "federal regulations (40 Federal Register 
. 2^/w^(J)ec. 4, 1975, pp. 56692-56695) do not define "mental health research," 
f bi^t da define "research" broadly to^ include behavioral science studies, 
J/ surveys, ^and evaluations. Within. these areas, unless the participant 
agrees-to the release of the information or release is required by a . ^ 
medical-emergency, a researcher who has received the authorization of the 
Secretary of Health, Education and Welfare, may refuse to comply with a 
subpoena issued by any branch of . government . * 

' ' ' ■■ 

For the past. several years, however,- the Attorney General lias ex- 
• erased a similar discretionary authority to extend an evidentiary 

privilege to drug research projects. Section ^502 (c) of the Controlled 
^Substances Act (Pub. L; No. 91-513, encoded as 21 U.S. C,A.^^872 (c)), 
empowered the Attorney General to: 

.. . . .authorize persons engaged in research to withhold the 
names and other identifying characteristics cff persons, who ^ * 

^re the subjects o.f such drug abuse research. ' PeJrsons who . 
* \ obtain this authorizationjoiiay not be. Compelled .in any Federal, 
State, or local civil, cAiainal, administrajfive, legislative, ^ 
or other proceeding to identify the sub j eye ts of research /for 
which such authorization was obta^i|^^Y . ^ 



ThiiS statute is very similar to the HEW statute. Forturiately,.\the pro- , 
cedures for awarding this privilege have been in existence long .enough 
to permit some general observations about ^he man"ner in whidh this 
administrative discretion has been exercised, (see Hedrick, Nelson, Cecil ,;1978).; 

Research data concerning criminal activities are especially vulnerable . 
to forced disclosure by court-ordered isubpoena.' The unwillingness of the 
courts to exercise 4;heir disfcretion to bar researchers' evidence of criminal 
activity has resulted in federal statutory. protection for criminal justice 
research. Section 524(a) of the Crime Control Act of 1973 (Pub. L. 93-83) 
• ; ' provides that identifiable research and statistical in^rmation may only 
. be used for the purpose for which it was obtained, and without the consent 

^vof the individual cannot be admitted as evidence or used for any purpqse 
r in any judicial or administrative proceeding. The statute provides^: 

Except as provided by Federal law other than this chapter, • ' . 
no officer or employee, of -the Federal Government, nor any/ 
recipient of assistance under the provisions of this chap t.er 
ishali. use or. reveal any research or statistical information 
furnished under t^his chapter by any person and identifiable 



■13". ■■■ ' • ^ 



to atiy. private person for any purpbs% other than the purpose . _ 
; ■ -for 'which it was obtained in accordance with this chapter. 
. Copies of such informa:t ion shall be ; immune from legal process, 
. and shall not, without the consent of : the person furnishing 
such information, be admitted as evidence or used for any 
purpose in any action, suit,, or other judicial or" administrative . . 
proceedings. (Encoded as 42 U.S. G. A. §3771,) 

The implementing regulations for the statute ' (41 Federal Register 54816, 
December 15, 1976) acknowledge that one of the purposes of providing such 
protection for criminal justice research is to increase the credibility 
and reliability of federally supported resekrch and statistical . firidings by 

minimizing Subject concern over subsequent uses of identifiable information. . 

•» • ... ■ . f . ' • . . ■ ■ ' 

. The scope of protection under this statute is quite broad, ek tending 
to research dnd statistical information obtained either directly or indir- 
ectly by the Law Enforcement Assistance Administration, or under any 
agreement, grant, or contract awarded under the Omnibus Crime CSntrol and 
Safe Streets Act. Such a relationship can be demonstrated for almost all 
federally sponsored criminal justice; research. Protected, Informatijlon nvay . 
be used qnly for statistics^ or i;esearch purposes and may .not . be used as 
evidence in- judicial or administrative proceedings . However, the statute 
leaves research inrdrmatipn vulnerable to a l^gisl ex- 
ception which the Law Enforcement-.,Ass^i^^ to 
be a shortcoming (Madden ,^1977) . Also'; the^, statutory protection does hot 
extend to inforination co""^!^ future criminal "conduct . . ^ . . 

A number of ; other "federal statutes offer protection. to record systems 
whicfi may occasionally be used in social scientific inquiries. Some statutes 
..offer protection £pr special categories of data. Special statutes protect 
census data (13 .U.S.C.A. §§8, 9) and social security data (42 U.S.C.A. §1306), 
but these protections e>ctend only to federal researchers and to outside re- 
searchers hired temporarily' as agency, personnel. . . 

Another form of federal statutory protection extends to specific topics 
of research. Federal^ 3urveys concerning venereal disease have received . 
statutory pro^tection. Information derived :from venereal disease treatment 
programs can be releaised for statistical or research purposes only if the 
identity of the indivi*dual provided care under a treatment program is not 
disclosed (42 U.S.C.A/ §247c(3)(5))v \ . ■ " . */ . 

. Statutory protection \has also been provided for specific research 
projects commissioned, "by Congress. For example, when authorizing a com-- ; 
p£ehensive statistical survey of runaway yp^ Congress indicatecj that^ 
identifiable records gathered in thfe cbuirse of the survey could i^ot undei^ 
any circmnstances be diisclosed (42 U.iS.C.A. §5732) . ■ / . • . • 



2 . Technical and Orgahizat ibnal Measures 



• TKe Privacy Act dedicates n6 .special attention to techuical and 
organization measures" for handlihg;; social science data. The handling 
practices which it alludes to. are^^eral, e;.*g,; riiles on disclosure are^general 
rather than specific^.. The Privacy .Prbtection Study Commission recognized ^ 
specific -topics: in report recognised and • \ 

(iefined concepts such- as Randomized response, ;m^^ 
error injection and the like, but provided r^^^ 

on recorimiendations ab6ut inforTnati.qn^^^^ for s-tatistical 

.research purposes, the eoimission'Repprt. proposes: notifying respondents 
that, records may be d:^scrosed fotf "secondary research purposes (Recoramendati 
//10>; using institutional review 'boa|ds to oversee colieotion of information . 
from those incapable of providing vj^untary consent (# 

Neither the Act nor the Privacy Co^missibn recOramQndatibns^^^^ • 
effect the use of conventional methods "for assurin-g confidentiality and |: 
data handling. Those, methods, s^&raaarized in Boruch* and Cecil (1978) , include : .|t 
■ '■ ' '"' •■ . ' ■': ■■■•„■. ■ " 

Procedural Approaches^ For longitudinal data collected perioditf^lly • * . 
within the s^me framework, the simple device of using alias identifiers . . 
is obvious, but underutilized; The alias: may be created by" the respondent . 
arid used consistently \in response to permit intrasystem linkage. It may 
be created by social . scientists, providied to the respondent , then plurged 
from the isocial scientistsV files to achieve the saiae ends. To decentralize 
the process, soiiie neutral brokerage agency (a census bureau, a nongovern- 
mental agency) may .similarly^create an alias .for the respondent and destroy 
its own: records of :*any linkage between clear identif ication arid alias. , 

The. strategy has been field; tested with some success, in U.S. drug - 
studies, political attitude suryi^ys and the like. ' Aside from longitudinal ^ 
prol)lems, its ma j.pr shortcomings arp the limitations imposed on linking /S'---.-'';, 
the data elicited under alias with ariy/'otheV existing data on iridividualsli^ - . • 

:To accommodate some ^logistical .problems' as well as the limitation on 
intefisysfem lli^kage,, procedures Siich as the; link file system have been 
developed'., in this technique, a dictionary of double aliiases is c^reated 
by the sdcial scientist and given over for safekeeping : to an independent^: • 
agency* The decentralization- of the process enhances physical security, ^ 

if *the -agency is legally entitled to resist governmental appropriation * . 
of files, the procedure is legally secure. The dictionary Is used as a 
basis for linking information which is periodically obtained from individuals. 
T^ie main benefit of the strategy is that it reduce^ the sdcial scientists' 
need to maintain longitudinals records on identified individuals, ; in general, 
arid it reduces the time during which the social scientist has.access to any- 
given Kaye of data 'containing identifiers to an arbitrarily short period 
; (see * Astin & Boruchj 1970) : , ^ , : : * 

For 'those cases in which records from::diffferent archives miist be ' 
linked, a variety 6f methods have been developed to permit linkaga without • 
violating the customs or law governing linkage. Among the better known 
systems for doing so is. the "mutually insulated f ile approach,!' used in 
the 'Schwartz-Orleans (19.67) referred to earlier. Basically, the system * 
involves -two files of records operated under different auspices; ailv.records 



are identified and- there Is some overlap between the samples of ' individuals, • 
on which Tthe records Are maintained, "^o accomplish the linkage, the first , 
archive /(as Slime it is the social scientist) cryptographically encodes the 
'information portion of each recot^ producing a new file without meaning /to. ; 
any diitsider;, which is : then transmitted to the record archive. The archive' . , 
then matches the encoded records with- its pim records, b on the clear 
idientif ier's appearing '' in each rQcard;. Upon completion , of the match, 
identifiers are deleted and. the linked records are returned to\the social 
scientist who then decodes relevant:^<^pdrt-ions of the linked records and • 
.conducts his statistical analysis /of the anonymous records. . Variations on the 
strategy are de'scribed in Boriich (1972> and .Campbeir\^ al^ (1975X. 

Statistical Approaches . The devices just described' are most often 
relevant to more impersonal forms of observation—questionnairejs and the like- 
rather than to direct interview research. And in some instances, the 
logistical difficulties attached to, their iise . are considerable,. Partly for 
these reasons; it may be moire appropriate to capitalize"^ on one of the 
statistical strategies which have been deviel5ped to reduce depreciation in 
privacy. A variety of these approaches exists and these may be used alone or 
in 'conjunction with the procedural devices. \ ^ 

/ The best known class of approaches is the randomized response tactic 
ciirrcatly under test and iege-lopmejit by Greenberg and others (1974) in the 
United .States, Dalenius (1975) , La^ Svenssoh, . and Eriksson 

in Sweden; Wa'mer in Canada, Moors in Holland, and others. In the simplest 
variation of the approach, the sicjtial scientist simult£nepusl^ presents .a 
sensitive inquiry to an individual, e.g., "Did you cheat on your income 
taxes this year?" and an insensitive one, e.g. , "Do^pu prefer potatoes 
oyer noodles?" The individual is then instructed tp roll a ^lie and respond 
td the first question if. a one or two shows up, and to the second quest.^.o.n 
if a three, fp^uf, five, or six shows. He is also told. to refrain from . 
giving the interviewer any indication of which qu'^stion .was answered.-. 
When the prociees. is carried put on two large samples of individuals and the 
instructions are followed by tfie respondent, it is possible to estimate the 
proportion of individuals in the sample who have cheated on their income 
tax forms and the proportion whp prefer noodles. In particular, given s^ta^ 
sample laws of prpbability, the odds ori answering one or the other question, 
ahd the^ observed proportion of Yes- responses, the estimation is a matter of *. 
simple algebra.. . * ^ ' .-; • s 

The technique permits us to establish .the statistical character of 
sensitive. properties of groups of individuals. And moreover, it does so. • \. 
without disclosing to the social scientist any . information about a particular 
individual. It has been field tested in drug studies, in fertility control 
Studies and other areas, and those tests continue in the U.S., Canada, 
Sweden, . and,, elsewhere. The basic method is. being tefined to make it more 
efficient in a statistical sense,; more acceptable to the respondent in a , 
social psychological siense, and less vulnerable to corruption in. a legal 



/"Another class of statistical' t^^ 
received s<Mne attention is\ aggregatiph of the* s 

.Quires thaA one obtain data not \ single identified individuals but rather, 
on very smll arid , care fully ^etms If the 

clusterls composition remainsi the same . oyer timey each cluster^^^^^^ 
certain conditions, ,be regarded as a synthetic person, a composite of all 
the propertiejs of the small set of iiridiViduals it c6mprises. Some informative . 
data analyses *^:an be conducted on those aggregates and, insofar as aggregation 
■ helps- to :^ssure; anonymity, of individiifi no depreciation ' 

of individual '.privacy, .. ' . 

\.r ■. -K"^" , -:v . ; . .• ' ; .' ■". :'■ ••. ^. .•■ , . ■ .■' ,. ■ ■ , ; .; ■•». 

The .applications- ot samp^ so far been limited , 

to economic research- on commercial units., Banl^s, for example, may be 
reluctant' to release .information' about their operatiqtis to any outside ' - . 
economist. They -are willing, h social scientist analyze 

aggregates, o.f ^banks' in. the anfceregit o.f reconciling, bank privacy with future^^ 
research. ' And. indeed,' "a, major, system of data maintenance artd 'dissemination 
has ."been built up on^ ithis . theme by ' the University, of Wisconsin (see Bauman , \ 
David,:: &: Miller. 1970) .V ' ^ 'i* '\ ■ • z^: ■ 

■ G. . Data Pro tec^'ibn' With Codes . of Ethics 

' ■ * • ' -^ ■ " ' ■ ' ' ' ' ■:■'■['■ ' ' V V ■. , . • ■ ' ■ ■': . • •. ■ 

. The inajority of the social science prof essiojial; groups in the United 
States* have developed codes of ethics for their membership^. Hajor eixceptions 
include the. American Economic Associat^iqn and th^ American Statistical Associ- ' 
ation. 'Each of the^-cod^s are described in a monograph by Robert Bowers (1978) 

It is unlikely that researchers V codes of ethics played any majj^ , 
. in formal or informal discussions leading up to the Privacy Act : research 
itself . was not given notable attention. The; Pr^^^ . 
■^Commission did ^elicit testimony from major professional organizations, |3ut 
codes of;^ethics were not discussed in any detail.^; Testimony from the American 
Sociological Association did emphasize the researcher Vs ethical respons'it?ility 
to assure t^at researcher assurarfces of cdnfidentiality were in fact maintained 
by the' researchers. The effect^ of this emphasis, or of sporadic reiteration • 
of 'ethical codes . to potential interrogators of research* records and to legis- 
lators is still unclear. : . :' 

./ " '* H« Implementation of Data. Protection Laws " . . 

1.. Specialized Personnel - ' 

. ■ ■ " ■ ■ .' ■ ■ ■ ' ■ ■ . ■ ■ .• ' ■ ' » 

There are. no special. provisions in the Privacy Act bearing on agency 
"privacy officers," i.e., the individual within agency who takes primary 
responsibility j^or meeting demands o^ the Act. Nor does the Act itself 
require officerar. ^ Similarly, ho other privacy legislation deals directly 
with special persoiinel. . Officers within agency have been designated jto 
oversee implementation of the Act, to meet the Office of Management and 
Budget guidelines on implementation. 
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In fact, know very little abaiit the selection /of individuals with/ 
responsibility for, assuring adherence to the Privacy Act*. or to any. other . 
privacy legislation;.: We know less about their performance, though it 's ■ 
clear that^in some instances , the officer's lack of skill and knowledge 
about statistical social research has led to. a conservative postulre arid j . . ' 
even truculence* toward the research. It's clear, 'that some officers feel 
uncomfortable enough aboiit the ambiguity of their role of -their agency ' s 
policies to^meet periodically to exchange views. Nothing is being done ' . 
to permit officers to learn from oxie another in a formalized way, through ♦ 
workshops for example, or to consolidate their experiences, through a 
regularly issued newsletter, for example, if complicated law is to be imple- 
mented welt (Boruch,- 1977). : 



\ 2. Dominant Bi^eaucratxc Behavior fir J 

•■ ■ ■ • ■ • ■ ■ • ' ' ■ ■ ■ . ■ ■ . \ . 

. There are several stereotypical behaviors. 



V : Generally, agency staff aire more cautious about attending to privacy ' 

matters. Regardless of the setting or outcome, the caution .takes time and 
negotiation; consequently some new reseiairch tak^s more time to initiat<e. 
At befit, ai few agency ^taff are quite agressive l^^nderstariding access 

. regulations^ and trying to assure that the researchers' needs are met in 

the confines of thti. act. , . . . ' ' % 

At the other end/of' the spectsrum, a few privacy officers are '^sufficiently 
intimidated by the legislation's emphasiV that saying ''No'' to researcher 
requests is. -almost automatic. Under these conditions, the appeals process w 
f . ^vkilable .under the Freedom of Infortaatton Act can be helpful. For instance, 
we recently requested that the Drug .Enforcement Administration supply ua .with^ 
the names" of refeearchers who had been granted testimonial privilege under . 
, DEA auspices. 'A libw level off icer in DEA refused initially to suppl^' the 
- names j claiming tlj^t disclosure would violate ;the individuals' privacy;: We . 
appealed that •decision under FOI and, after 10. mouths ^ received the list. ; 

• '/v'-^ < '■■■. ■■■■- ■^ ■ ■ 

' 3* The Effect of General Rules on Reducirig^^tJi^gbretiori \ 

. " ■ ■ ' ' : . ' ' ' ' ■ ■:^^'^#'>/ -^^ ] ' ' ■.• '■■ 

' ^The privacy laws and the iegulatio^is do re<|uy^e bureaucrati discretion ; . 
in restricting access to identifiable data^ The^vi^^^ 

itp impede access tp. statistical vdata though that: is^-o^^^ of the 

law. In this, sense, the laws increaise discretion by:|)'roVa.ding a^ 
for refusing to dlsclqse^ data- ' ' ■ .M-vy'"^^:.'^:^ 

For example, a large sphool district recently refuse^^ re-r 
searcher's sampling of anonymous records from. school f iles. . -^^^^^ ; 
were interested in assessing the quality of recorrf content s,^'^^'^^^^^^^ as. accuracy 
in diagnosis, especially on minority group students enrolled dnl^pecial 
CFederally supported). programs. The school's refustl to /provide a, sample ^ 
of anonymous records was based on the Privacy Act and on ather privacy law, • 
but was cpunteraanded by the courts. In this and similar cases, the 'Privacy. 
Act becomes a: convenient vehicle for insulating the institution from legiti- 
mate research, and investigation, rather than prbtecting the individual'. 



. Discretion for gove,rnmeht njanagers may als6^ be reduced indirectly . 
thrdiigh increased demands on their time> Jabine (1975) , for. example, 
arid others observe that ".several more steps h^ye been added to already ' 
comiplex clearance procedures for initiating and conducting surveys," 
that "access and accounting requirements will cause delays in normal ^ . 
processing -a€4:ivities" as** a consequence of ^the Privacy Act of 1974 in 
the Office of Reisearch arid Statistics, of the Social Security Administration. 
That reduction in discretion may- reduce the quality of data or operations, . 
at least temporarily, since privacy legislation incluides no additional 
firiancial support or staff for meeting its requirements. ' . 
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Footnotes 



l- Prepared for the liiterijational ^^^^^^ Protection .' 

.. and the Social Scj,etwr^ Need, for Access-to Data, ^ 
. .. , Coinmit;^tee of European Social Science Data Archives (CESSDA) and the 
'International Federation , of Data Organizations (IFDO) , .Cpiogne ' 
Germany, August 9-11, 1978.: . This . paper was developed with lupp^^^ 
.a grant from the Natipnal Science Foundation (NSF.-APR 77-00349). Our. 
background research-on privacy in sfJcial research lias been supported ' ' 
-\ . by the- National Institute of Education (NiE-C-74-0115) . ^ 

2. The most thorough analysis, to date* of the research implications of 

the Privacy Act is given by. Cecil (1978) from which somp of the current ' 
.material is adopted. Papers, an the topic We been developed by i 
V; ' . .. executives of federal archive agencies such as the U. S. Cehsus and the " 
.Social Security Administration;" see Duncan (1975) and Jabine (1975)1 I. 

3. [bne model in which the Census Bureau serves as broker for the Burdau • 
. of .Labor Statistics is clearly .still legitiihate under, the Privacy Aci;. 

Census- obtains employment information ,. on behal-f of BLS , from identifiable 
individuals in its Current Population Surveys; TheS^ureau 's'^rips result- 
ing records of identifiers and turns the microdata over to BLS ^or analysis 
(Yates, 1974). The linkage of samples of various types of records, from 
the Internal Revenue Servipe, Social Security, and Census, for example, ' 
_ • also remains legit;imate under the Act; the Census Bureau also serves as 
,, broker in this resbarch on consistency of information from different 
sources (.Jabine, 1975). . ^ 

4. The Act's posture .toward disclosure of anonymous records for research 
purposes is consistent with the P9licy of various U.S. agenciesv Public 
^s^ tapes ire available from, among others, the U.S. C ensus Bureau, the 

: Social Security Administration, and . the Nati^lT Center for__Educational 
- Statistics. ^!C.he- spirit of the- Act is also consistent with" the Bellagio 
principles (Flaherty,. 1978) which encourage the use of government micro- 
dat^, in anqnymous form, for research purposes. Both the Act and the 
Bellagio^ principles . are compatible with more recent efforts by some ' 
^ federal. agencies , to assure that, data stemming from federal program ' 
- , ^ .evaluations, are available, with identifiers removed, for secondary 

^ . analysis. Those -agencies include the National Institute of Education 
; . wWch .has:- made data from.; the Educational Vouchers Experiment and; o^^^ 

' ^^ailabj^e. And it includes^ the Law Enforcement Assistance AdMnistration 
. ^ .which has an explicit policy on disclosure-of^statistical data stemmiiie ' 
^ .--from any LEAA' supported project. ^ \' . • 
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